3.5

Adjusted Signal

3.5

Raw Pattern Score

100%

Time Factor

2026-11-01

Last Push

3.7K

Stars

Language

40.9K

Lines of Code

344

Files

105

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 12.6/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 96 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.1/100 · LOW

Are imports declared and package/API names verified? 1 finding(s).

Agent Over-Engineering Ratio 4.1/100 · LOW

Are wrappers, guards, and repeated structures necessary? 11 finding(s).

PR Review Velocity Impact 14.4/100 · LOW

Which changes need focused human review? 105 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 11LOW 94

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 105 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block70 hits · 70 pts

Severity	File	Line	Snippet	Context
LOW	eng/common/SetupNugetSources.sh	1	#!/usr/bin/env bash	COMMENT
LOW	eng/common/vmr-sync.sh	1	#!/bin/bash	COMMENT
LOW	eng/common/vmr-sync.sh	21	###	COMMENT
LOW	eng/common/native/init-distro-rid.sh	1	#!/bin/sh	COMMENT
LOW	eng/common/native/init-distro-rid.sh	61		COMMENT
LOW	…common/templates-official/variables/pool-providers.yml	1	# Select a pool provider based off branch name. Anything with branch name containing 'release' must go into an -Svc pool	COMMENT
LOW	eng/common/templates/vmr-build-pr.yml	1	# This pipeline is used for running the VMR verification of the PR changes in repo-level PRs.	COMMENT
LOW	eng/common/templates/variables/pool-providers.yml	1	# Select a pool provider based off branch name. Anything with branch name containing 'release' must go into an -Svc pool	COMMENT
LOW	eng/common/core-templates/stages/renovate.yml	1	# --------------------------------------------------------------------------------------	COMMENT
LOW	…g/common/core-templates/steps/get-github-app-token.yml	1	# Mints a short-lived GitHub App installation access token by signing a JWT	COMMENT
LOW	eng/common/core-templates/steps/install-microbuild.yml	1	parameters:	COMMENT
LOW	eng/common/core-templates/job/renovate.yml	1	# --------------------------------------------------------------------------------------	COMMENT
LOW	eng/common/core-templates/job/source-build.yml	1	parameters:	COMMENT
LOW	eng/common/core-templates/job/source-build.yml	21	# published by source-build.	COMMENT
LOW	eng/common/core-templates/job/helix-job-monitor.yml	81	# well (--use-fully-qualified-test-name). Opt-in because it changes AzDO test identity and display;	COMMENT
LOW	src/System.CommandLine/RootCommand.cs	61	public IList<Directive> Directives { get; }	COMMENT
LOW	src/System.CommandLine/LocalizationResources.cs	81	/// Interpolates values into a localized string similar to Argument '{0}' not recognized. Must be on	COMMENT
LOW	src/System.CommandLine/LocalizationResources.cs	141	/// Interpolates values into a localized string similar to Arguments:.	COMMENT
LOW	src/System.CommandLine/LocalizationResources.cs	201	/// Interpolates values into a localized string similar to Unhandled exception: .	COMMENT
LOW	src/System.CommandLine/Argument.cs	41		COMMENT
LOW	src/System.CommandLine/Argument.cs	61		COMMENT
LOW	src/System.CommandLine/Argument.cs	121	}	COMMENT
LOW	src/System.CommandLine/InvocationConfiguration.cs	21	/// <value>The default is two seconds.</value>	COMMENT
LOW	src/System.CommandLine/ParseResult.cs	81	}	COMMENT
LOW	src/System.CommandLine/ParseResult.cs	121	/// </summary>	COMMENT
LOW	src/System.CommandLine/ParseResult.cs	141	/// <exception cref="ArgumentException">No symbol was defined for the given name for the parsed command.</except	COMMENT
LOW	src/System.CommandLine/ParseResult.cs	161	public T GetRequiredValue<T>(Option<T> option)	COMMENT
LOW	src/System.CommandLine/ParseResult.cs	181	/// <param name="argument">The argument for which to find a result.</param>	COMMENT
LOW	src/System.CommandLine/ParseResult.cs	201		COMMENT
LOW	src/System.CommandLine/Command.cs	81	internal bool HasSubcommands => _subcommands is not null && _subcommands.Count > 0;	COMMENT
LOW	src/System.CommandLine/Command.cs	221		COMMENT
LOW	src/System.CommandLine/Command.cs	241	[DebuggerStepThrough]	COMMENT
LOW	src/System.CommandLine/Option.cs	41	public bool HasDefaultValue => Argument.HasDefaultValue;	COMMENT
LOW	src/System.CommandLine/Option.cs	81	/// Gets the <see cref="Type" /> that the option's parsed tokens will be converted to.	COMMENT
LOW	src/System.CommandLine/Option.cs	101	/// If set to <see langword="true"/>, the following command line is valid for passing multiple arguments:	COMMENT
LOW	src/System.CommandLine/ParserConfiguration.cs	1	// Copyright (c) .NET Foundation and contributors. All rights reserved.	COMMENT
LOW	src/System.CommandLine/ParserConfiguration.cs	21	/// > myapp -a -b -c	COMMENT
LOW	src/System.CommandLine/ArgumentArity.cs	121	/// An arity that may have one value, but no more than one.	COMMENT
LOW	src/System.CommandLine/Directive.cs	1	// Copyright (c) .NET Foundation and contributors. All rights reserved.	COMMENT
LOW	src/System.CommandLine/Invocation/CommandLineAction.cs	21	/// Indicates that the action clears any parse errors associated with symbols other than one that owns the <see cref	COMMENT
LOW	…CommandLine/Invocation/SynchronousCommandLineAction.cs	1	// Copyright (c) .NET Foundation and contributors. All rights reserved.	COMMENT
LOW	src/System.CommandLine/Completions/CompletionItem.cs	1	// Copyright (c) .NET Foundation and contributors. All rights reserved.	COMMENT
LOW	src/System.CommandLine/Completions/CompletionItem.cs	41		COMMENT
LOW	…cs.CodeAnalysis/DynamicallyAccessedMembersAttribute.cs	1	// adapted from: https://github.com/dotnet/aspnetcore/blob/404d81767784552b0a148cb8c437332ebe726ae9/src/Shared/CodeAnal	COMMENT
LOW	…cs.CodeAnalysis/DynamicallyAccessedMembersAttribute.cs	21	///	COMMENT
LOW	…nostics.CodeAnalysis/DynamicallyAccessedMemberTypes.cs	1	// adapted from: https://github.com/dotnet/aspnetcore/blob/404d81767784552b0a148cb8c437332ebe726ae9/src/Shared/CodeAnal	COMMENT
LOW	…nostics.CodeAnalysis/DynamicallyAccessedMemberTypes.cs	21	None = 0,	COMMENT
LOW	…nostics.CodeAnalysis/DynamicallyAccessedMemberTypes.cs	41	PublicMethods = 0x0008,	COMMENT
LOW	…nostics.CodeAnalysis/DynamicallyAccessedMemberTypes.cs	61	PublicNestedTypes = 0x0080,	COMMENT
LOW	….CodeAnalysis/UnconditionalSuppressMessageAttribute.cs	1	// adapted from: https://github.com/dotnet/runtime/blob/a5159b1a8840632ad34cf59c5aaf77040cb6ceda/src/libraries/System.P	COMMENT
LOW	….CodeAnalysis/UnconditionalSuppressMessageAttribute.cs	41	/// Gets the category identifying the classification of the attribute.	COMMENT
LOW	….CodeAnalysis/UnconditionalSuppressMessageAttribute.cs	61	/// <remarks>	COMMENT
LOW	….CodeAnalysis/UnconditionalSuppressMessageAttribute.cs	81	/// <remarks>	COMMENT
LOW	…m.CommandLine/System.Runtime.CompilerServices/Range.cs	1	// https://github.com/dotnet/runtime/blob/419e949d258ecee4c40a460fb09c66d974229623/src/libraries/System.Private.CoreLib	COMMENT
LOW	…m.CommandLine/System.Runtime.CompilerServices/Range.cs	101	/// <summary>Gets a value that indicates whether the index is from the start or the end.</summary>	COMMENT
LOW	…m.CommandLine/System.Runtime.CompilerServices/Range.cs	161	/// int[] someArray = new int[5] { 1, 2, 3, 4, 5 };	COMMENT
LOW	src/System.CommandLine/Parsing/SymbolResult.cs	61	/// </summary>	COMMENT
LOW	src/System.CommandLine/Parsing/SymbolResult.cs	81	/// </summary>	COMMENT
LOW	src/System.CommandLine/Parsing/Token.cs	61	public override string ToString() => Value;	COMMENT
LOW	src/System.CommandLine/Parsing/TokenType.cs	1	// Copyright (c) .NET Foundation and contributors. All rights reserved.	COMMENT
10 more matches not shown…

Decorative Section Separators6 hits · 27 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	eng/common/core-templates/stages/renovate.yml	1	# --------------------------------------------------------------------------------------	COMMENT
MEDIUM⚡	eng/common/core-templates/stages/renovate.yml	3	# --------------------------------------------------------------------------------------	COMMENT
MEDIUM⚡	eng/common/core-templates/stages/renovate.yml	9	# --------------------------------------------------------------------------------------	COMMENT
MEDIUM⚡	eng/common/core-templates/job/renovate.yml	1	# --------------------------------------------------------------------------------------	COMMENT
MEDIUM⚡	eng/common/core-templates/job/renovate.yml	3	# --------------------------------------------------------------------------------------	COMMENT
MEDIUM⚡	eng/common/core-templates/job/renovate.yml	17	# --------------------------------------------------------------------------------------	COMMENT

Redundant / Tautological Comments9 hits · 14 pts

Severity	File	Line	Snippet	Context
LOW	eng/common/tools.sh	334	# Check if the script is older than 30 days using timestamp file	COMMENT
LOW	eng/common/tools.sh	443	# Check if the toolset has already been extracted	COMMENT
LOW	eng/common/SetupNugetSources.sh	66	# Check if disabledPackageSources section exists	COMMENT
LOW	eng/common/SetupNugetSources.sh	72	# Check if this source name is disabled	COMMENT
LOW	eng/common/SetupNugetSources.sh	92	# Check if source already exists	COMMENT
LOW	eng/common/SetupNugetSources.sh	122	# Check if disabledPackageSources section exists	COMMENT
LOW	eng/common/SetupNugetSources.sh	192	# Check if there is no existing credential for this FeedName	COMMENT
LOW	eng/common/core-templates/steps/source-build.yml	31	# Check if AzDO substitutes in a build config from a variable, and use it if so.	COMMENT
LOW	eng/common/core-templates/steps/install-microbuild.yml	64	# Check if ESRP is disabled while SignType is real	COMMENT

Example Usage Blocks4 hits · 7 pts

Severity	File	Line	Snippet	Context
LOW	eng/common/native/install-dependencies.sh	7	# Usage:	COMMENT
LOW	…common/templates-official/variables/pool-providers.yml	12	# How to use:	COMMENT
LOW	eng/common/templates/variables/pool-providers.yml	12	# How to use:	COMMENT
LOW⚡	eng/common/core-templates/job/renovate.yml	11	# Usage:	COMMENT

Deep Nesting6 hits · 6 pts

Severity	File	Line	Context
LOW	eng/common/cross/install-debs.py	20	CODE
LOW	eng/common/cross/install-debs.py	196	CODE
LOW	eng/common/cross/install-debs.py	221	CODE
LOW	eng/common/cross/install-debs.py	259	CODE
LOW	eng/common/cross/install-debs.py	293	CODE
LOW	eng/common/cross/install-debs.py	348	CODE

Self-Referential Comments2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	eng/common/cross/build-rootfs.sh	687	# Create the symlink in the same directory	COMMENT
MEDIUM	eng/common/core-templates/job/helix-job-monitor.yml	170	# Create a minimal NuGet.config that only references the local nupkg directory.	COMMENT

AI Slop Vocabulary2 hits · 4 pts

Severity	File	Line	Snippet	Context
MEDIUM	eng/common/cross/install-debs.py	126	# keyboxd, which makes it robust on hosts running GnuPG 2.4+ (e.g. Azure	COMMENT
LOW	…ommon/core-templates/steps/enable-internal-sources.yml	34	# If running on dnceng (internal project), just use the default behavior for NuGetAuthenticate.	COMMENT

Excessive Try-Catch Wrapping2 hits · 4 pts

Severity	File	Line	Snippet	Context
MEDIUM	eng/common/cross/install-debs.py	42	print(f"Error downloading {url}: {type(e).__name__} - {e}. Retrying...")	CODE
MEDIUM	eng/common/cross/install-debs.py	206	print(f"Error: Package '{current}' was not found in the available packages.")	CODE

Hyper-Verbose Identifiers3 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	eng/common/cross/install-debs.py	49	async def download_deb_files_parallel(mirror, packages, tmp_dir):	CODE
LOW	eng/common/cross/install-debs.py	65	async def download_package_index_parallel(mirror, arch, suites, check_sig, keyring):	CODE
LOW	eng/common/cross/install-debs.py	337	def _rootfs_extraction_filter(member, dest_path):	CODE

Unused Imports1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	eng/common/cross/install-debs.py	18		CODE

dotnet/command-line-api

Open-Source Code Quality, Security and Technical Debt Review